CYFIRMA Research

An active phishing campaign is leveraging Microsoft Teams-themed lures to distribute legitimate remote access software configured for unauthorized access.
 
The campaign highlights a growing trend in cybercrime operations: leveraging trusted platforms, legitimate software, and reputable hosting providers to bypass conventional security controls.

As threat actors continue shifting toward legitimate software abuse and trusted infrastructure, reliance on signatures and domain reputation alone is no longer sufficient.

Link to the Research Report: https://www.cyfirma.com/research/microsoft-teams-themed-remote-access-phishing-campaign/

#CYFIRMA #ThreatIntelligence #CyberSecurity #Phishing #MicrosoftTeams #ThreatHunting #SOC #BlueTeam #CyberDefense #DFIR #ThreatResearch #CyberThreats

https://www.cyfirma.com/

CYFIRMA's latest research documents how adversaries are exploiting the Model Context Protocol, the integration standard now embedded in Claude, Copilot, Cursor, VS Code, and hundreds of enterprise AI platforms, to turn AI agents into autonomous attack infrastructure.

If your organization has deployed MCP-connected agents in production, the decisions this report describes are available now.

#ThreatIntelligence #CyberSecurity #AI #MCP #AgenticAI #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Alert : Major NPM Supply Chain Attack Exposed: 2.7M+ Downloads Impacted

CYFIRMA Researchers identified 11 malicious npm packages targeting blockchain and Web3 developers, highlighting the growing risks within the open-source software supply chain.

The attack demonstrates how a single typo or unverified dependency can introduce malicious code into development workflows. As Web3 adoption grows, software supply chains continue to be a high-value target for threat actors seeking access to sensitive credentials and digital assets.

Organizations should strengthen dependency validation, continuously monitor open-source components, and enforce security controls across development pipelines.

Link to the Research Report: https://www.cyfirma.com/research/new-npm-supply-chain-campaign-identified-a-multi-stage-cryptocurrency-malware-with-more-than-2-7-million-downloads/

#CYFIRMA #CyfirmaResearch #CyberSecurity #ThreatIntelligence #SupplyChainSecurity #OpenSourceSecurity #npm #Web3 #Blockchain #MalwareAnalysis #DevSecOps #ApplicationSecurity #SoftwareSupplyChain #ThreatResearch #InfoSec #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

48 teams
3 host nations.
Billions of viewers

And a cyber-attack surface unlike anything seen before.

As global anticipation for the FIFA World Cup 2026 grows, so does cybercriminal interest. Our assessment identified FIFA-themed phishing domains, fraudulent ticketing infrastructure, and malicious streaming platforms already leveraging tournament branding.

Looking ahead, organizations should prepare for increased phishing activity, fake ticket scams, DDoS attacks targeting public-facing services, and threats against broadcast and media infrastructure.

The World Cup isn't just a sporting event.

It's a cyber battlefield waiting to happen.

Link to the Research Report: https://www.cyfirma.com/research/cyber-threats-surrounding-the-fifa-world-cup-2026/

#FIFA2026 #CyberThreats #ThreatIntel #OSINT #CyberSecurity #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA Healthcare Industry Report | Q2 2026 | Overall industry risk: 6.9 / 10 - ELEVATED

90 days of telemetry. 5 threat categories. Here is what the numbers say about the healthcare sector this quarter.

Ransomware across the period: 216 victims across 42 countries, up 8.5% from 199 last quarter, with 50 of 81 active gangs recording healthcare targets (62% participation, the highest rate observed across all sectors this period). Hospitals, pharmaceuticals, and specialized medicine were the most targeted sub-sectors. Activity oscillated within a stable band from September through February before March broke the pattern and April spiked to 90 victims. The June figure reflects a partial window and should not be interpreted as a genuine decline. A baseline of 220 to 260 victims over the next 90 days is plausible if the elevated tempo established in March and April persists.

Elsewhere in the data: 10 APT campaigns touched healthcare organisations across 34 countries, featuring the most diverse nation-state actor mix across all sectors this period, spanning North Korean, Russian, Chinese, and Iranian groups, with web portals and access management software targeted pointing to credential theft and patient data collection as primary objectives. 207 CVEs were identified over the period, with RCE vulnerabilities stabilizing above initial levels after a mid-period spike and injection attacks tripling mid-period, categories carrying outsized risk in environments where system disruption directly impacts patient care. Dark web chatter collapsed in the final period across breach and leak categories, assessed as reflecting forum disruptions and fragmentation rather than reduced threat activity, with ransomware remaining the most consistent and sustained signal across all three periods.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-may-2026/

https://www.cyfirma.com/

Threat Research: Operation Tax Shadow

Explore CYFIRMA's latest report regarding a tax-themed phishing campaign impersonating government tax authorities across multiple countries.

• Multi-stage malware delivery via ZIP archive
 • DLL Search Order Hijacking for stealthy execution
 • API Hooking and Access Token Manipulation
 • COM Callback-based code execution to evade monitoring
 • Modified RC4 encryption protecting payloads
 • Reflective PE Loading enabling memory-resident execution
 • LLVM-based Control Flow Flattening (CFF) for anti-analysis
 • WebSocket-based Command-and-Control communication
 • Infrastructure reuse observed across Indian and Japanese tax-themed phishing portals
 • Chinese-language artifacts identified during analysis
• C2 Communication observed with 43[.]128[.]54[.]184:1234
•Self-protection mechanisms make the malware difficult to terminate during execution

Impact: Full remote access, in-memory execution, and advanced defense evasion capabilities.

Link to the Research Report: https://www.cyfirma.com/research/operation-taxshadow-multi-region-tax-phishing-in-memory-malware-campaign/

#CYFIRMAresearch #ThreatIntelligence #MalwareAnalysis #CyberSecurity #ThreatResearch #Phishing #SOC #ThreatHunting #CYFIRMA #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Kenya’s cyber threat landscape is intensifying.

The latest CYFIRMA report reveals a surge in ransomware activity, credential leaks, dark web data trading, website defacements, and attacks targeting government, finance, telecom, and critical infrastructure sectors throughout 2025–2026. From ransomware groups like Qilin and RansomHub to large-scale underground credential sales and AI-driven phishing campaigns, threat actors are increasingly focusing on Kenya’s rapidly expanding digital ecosystem. With 120+ website defacements and growing risks to citizen data and public services, strengthening cyber resilience and proactive threat intelligence has become more critical than ever.

Link to the Research Report: https://www.cyfirma.com/research/kenya-cyber-threat-landscape-report-2025-2026/

#CyberSecurity #ThreatIntelligence #Kenya #Ransomware #DarkWeb #ThreatLandscape #Hacktivism #CyberThreats #CYFIRMA #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

The CYFIRMA Research team has identified key security insights related to CVE-2026-34197, a high-severity remote code execution vulnerability affecting Apache ActiveMQ Classic deployments.

The vulnerability arises from exposure of the Jolokia JMX-HTTP bridge, which allows authenticated attackers to invoke privileged broker management operations and abuse the addNetworkConnector() functionality to load attacker-controlled remote Spring XML configurations.

Our research highlights the exploitation methodology, exposure landscape, affected versions, and mitigation strategies to help organizations reduce the risk associated with exposed Apache ActiveMQ management interfaces.

Link to the Research Report: https://www.cyfirma.com/research/cve-2026-34197-jolokia-exposure-enables-rce-in-apache-activemq/

#CYFIRMAResearch #CyberSecurity #ThreatIntelligence #VulnerabilityResearch #ETLM #CVE202634197 #CYFIRMA #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

China’s cyber threat landscape is evolving faster than ever — and the implications go far beyond its borders.

Our latest threat intelligence report 2025 – 2026 highlights a convergence of ransomware, state-sponsored espionage, and systemic infrastructure risk that organizations cannot afford to ignore.

From hyper-targeted phishing to faster vulnerability exploitation, AI is increasing both the speed and precision of cyberattacks. 

Link to the Research Report: https://www.cyfirma.com/research/china-cybersecurity-threat-intelligence-report/

#CyberSecurity #ThreatIntelligence #Ransomware #APT #CyberRisk #ZeroTrus #CyberResilience #Geopolitics

https://www.cyfirma.com/

The increasing digitalization of India’s education sector has created a growing attack surface for cybercriminals targeting student-related data. Our latest threat intelligence assessment explores how exposed or misused student information is being leveraged for phishing, social engineering, impersonation, credential theft, and financial fraud. 

The report highlights multiple observed cases involving fake university portals, insider misuse of student records, fraudulent fee collection schemes, data exposure incidents, and student-linked mule account activity. It also examines how threat actors exploit trusted academic themes such as admissions, scholarships, internships, and fee payments to make scams appear legitimate and improve targeting accuracy. In addition to analysing the attack chain and operational methods used by threat actors, the report assesses the potential risks to students, educational institutions, and the broader financial ecosystem, along with key recommendations aimed at reducing exposure to these evolving threats.

Link to the Research Report: https://www.cyfirma.com/research/weaponization-of-indian-student-data-an-ecosystem-for-phishing-social-engineering-and-financial-fraud/

#CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement #StudentData #Phishing

https://www.cyfirma.com/